feat(cli): airs doctor — credential and connectivity preflight

[cdot65]

Summary

airs doctor runs 6 preflight checks — node version, config file validity, both credential groups (with source: env/file), scanner API reachability, management OAuth — and prints ✓/⚠/✗ with fix hints. Exit 0 when no failures (warns OK), 1 otherwise. --output json|yaml for CI use.

Notable decisions

• Scanner check uses queryByScanIds([randomUUID()]) — validates auth + reachability with zero scan quota burned
• Management check uses listTopics() — smallest authenticated GET, forces token fetch
• SDK errors carry no .status; auth failures detected by message pattern (tested) so bad keys read "API key rejected" not "network unreachable"
• All network checks time-boxed 5s

Testing

• 30 new tests (injected fakes: resolve/reject/hang paths, exit logic, json shape); 750/750; gates clean
• Smoke: real creds 6/6 pass exit 0; bogus key → scanner fail exit 1

Checklist

• TDD
• Gates green
• Docs + changeset (minor)

Closes #273